Who owns Lakera?
Check Point acquired Lakera. Lakera is known for Gandalf, its public prompt-injection challenge.
Beam vs CHECK POINT
Beam vs Lakera
Lakera, now part of Check Point, does runtime security for generative AI applications and is widely known for Gandalf, its public prompt-injection challenge. That is application-layer protection. Beam sits at the developer endpoint: recording coding-agent activity, workspace policy on Claude Code and Codex, Sentinel on browser AI chats, and heuristic skill/MCP scans.
Beam vs Lakera, side by side
Details below are drawn from a September 2026 review of the AI agent security market. Some figures are vendor-sourced or analyst estimates, and this is a fast-moving space — check with each vendor before you buy. Composio details come from its own pricing and documentation pages as of October 2026.
| Beam | Lakera (Check Point) | |
|---|---|---|
| What it is | Local-first activity monitor, policy enforcement, and pre-run scanner for AI coding agents, with a Sentinel browser extension for AI chats. | Runtime GenAI security, acquired by Check Point. |
| Monitoring | Shell commands, file changes, tool calls, network endpoints and browser actions from harnesses such as Claude Code, Codex and Cursor, plus Beam Sentinel checks on supported AI chat sites before send. Normalised into local NDJSON with risk flags and evidence attached. | Runtime security for generative AI applications. |
| Skill / MCP scanning | Yes. SKILL.md files and MCP configurations are scanned before you run them, using 11 heuristic patterns plus an MCP version-pin check. Workspace admins can also block an MCP server for the org or one user. | Not specifically covered in our source research. |
| Blocking / enforcement | Yes. Workspace owners and admins set observe, advisory, or enforce policy. Enforce denies matching tool calls on Claude Code and Codex PreToolUse hooks. The Sentinel Chrome extension pauses or blocks high-risk browser sends and can hold a send after redacting live secrets. | Runtime protection is core to the product. |
| Individual use | Free for up to 3 people, and Pro for one person at $8/month. Team workspaces add owner/admin roles, org baselines, stricter member overrides and a control plane. | None listed, though Gandalf is publicly available as a prompt-injection game. |
| Deployment | Local collector plus a workspace dashboard. Apple and Windows MDM. Sentinel Chrome extension for browser AI chats. Licensed self-hosted control plane for teams that need it on their own infrastructure. | Enterprise deployment within Check Point. |
| Source / licence | AGPL-3.0 for the local CLI and collector; the multi-user control plane is proprietary. | Commercial, not open source. |
| Pricing | Free for up to 3 people. Pro $8/month for one person. Team $20 per developer and $5 per browser seat a month, billed yearly. | Enterprise, no public price. |
Lakera in numbers
As reported in our source research. Some figures are estimates.
- Acquisition
- Acquired by Check Point
- Known for
- Gandalf, its public prompt-injection challenge
- Focus
- Runtime GenAI security
Where Lakera does more
- Runtime protection for generative AI applications, backed by Check Point's enterprise reach.
- Deep public credibility on prompt injection through Gandalf.
- Enforcement at the GenAI application runtime, which is a different control point from Beam's laptop hooks and Sentinel.
Where Beam differs
- Beam watches coding agents on a developer machine rather than GenAI applications in production.
- Beam's scan reads a skill file or MCP configuration before you run it.
- Beam is local-first, with no service to route traffic through.
Beam’s current gaps
- Enforce is hook-based: a native deny is wired for Claude Code and Codex PreToolUse. Cursor, Copilot CLI and Gemini currently get a deny note, not a verified block.
- Missing, unreadable or expired cached policy allows the action. Beam is not a fail-closed kernel sandbox or an in-silicon watchdog.
- Scanning is heuristic pattern matching. It produces false positives, misses novel phrasing, and is not a guarantee of safety.
- There is no SOC 2 report and no default SIEM forwarder. Kernel isolation like OpenShell remains a different layer.
Which one fits
If you are protecting a GenAI application at runtime, Lakera is built for that and has Check Point behind it. Beam is for the other end of the problem: the agent running on an engineer's laptop.
FAQ
Does Lakera monitor local coding agents?
Our source research describes runtime GenAI security rather than developer-endpoint monitoring, which is Beam's focus.
Does Beam stop prompt injection?
No. Beam flags heuristic patterns in skill files and MCP configs before you run them, can deny matching Claude Code and Codex tool calls under enforce policy, and can pause or block high-risk browser sends via Sentinel. It does not intercept prompt-injection against a production GenAI app the way Lakera does.
See how Beam works
Beam is an early, local-first prototype. Read what it actually does today before comparing it further.